Qualys Cloud Platform

Free Services

Microsoft security alert.

August 10, 2010

Advisory overview

Qualys Vulnerability R&D Lab has released new
vulnerability checks in the Qualys Cloud Platform to protect
organizations against
35 vulnerabilities
that were fixed in
15 bulletins
announced today by Microsoft. Customers can immediately audit
their networks for these and other new vulnerabilities by accessing
their Qualys subscription. Visit our blog to see how to prioritize remediation.

Impact of workaround #1: Disabling icons from being displayed for shortcuts prevents the issue from being exploited on affected systems. When this workaround is implemented, shortcut files and Internet Explorer shortcuts will no longer have an icon displayed.

2) Disabling the WebClient service helps protect affected systems from attempts to exploit this vulnerability by blocking the most likely remote attack vector through the Web Distributed Authoring and Versioning (WebDAV) client service.

Impact of workaround #2: When the WebClient service is disabled, Web Distributed Authoring and Versioning (WebDAV) requests are not transmitted. In addition, any services that explicitly depend on the Web Client service will not start, and an error message will be logged in the System log.

3) Blocking the download of LNK and PIF files on the Internet Gateway provides protection against remote exploitation of these attacks.

The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling. The kernel is prone to the following vulnerabilities:

An elevation of privilege vulnerability exists in the Windows Kernel due to the way the kernel deals with specific thread creation attempts. (CVE-2010-1888)

An elevation of privilege vulnerability exists in the Windows Kernel due to the way the kernel initializes objects while handling certain errors. (CVE-2010-1889)

A denial of service vulnerability exists in the way that the Windows kernel validates access control lists on kernel objects. (CVE-2010-1890)

An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode or cause system to become unresponsive and automatically restart . An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Solution

Patch:
Following are links for downloading patches to fix the vulnerabilities:

The Windows kernel is the core of the operating system. It provides system-level services such as device management and memory management, allocates processor time to processes, and manages error handling. The kernel is prone to the following vulnerabilities:

A denial of service vulnerability exists because the Windows kernel-mode drivers do not properly validate an argument passed to a system call.

An elevation of privilege vulnerability exists because the Windows kernel-mode drivers do not properly handle certain exceptions.

An elevation of privilege vulnerability exists because the Windows kernel-mode drivers do not properly allocate memory when copying data from user mode.

An elevation of privilege vulnerability exists because the Windows kernel-mode drivers do not properly validate input passed from user mode.

The Windows kernel-mode drivers do not properly validate pseudo handles within callback parameters when creating a new window allowing privilege escalation attacks to be conducted.

Microsoft has released a security update that addresses the vulnerabilities by correcting the manner in which Windows kernel-mode drivers handle exceptions, allocate memory, and validate system call arguments, user-mode input, and new window callback parameters.

The Secure Channel (SChannel) security package is a Security Support Provider (SSP) that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) Internet standard authentication protocols. It is prone to the following vulnerabilities:

A spoofing vulnerability exists in the TLS/SSL protocol, implemented in the Microsoft Windows SChannel authentication component.

A remote code execution vulnerability exists in the way that SChannel on a client machine validates a certificate request message sent by the server.

Microsoft has released a security update that addresses the vulnerabilities by implementing RFC 5746 and additional validation on SSL responses returned by a server.

This security update is rated Critical for all supported editions of Windows XP and Windows Server 2003; and Important for all supported editions of Windows Vista, Windows Server2008, Windows 7, and Windows Server 2008 R2.

The more severe of these vulnerabilities could allow remote code execution if a user visits a specially crafted Web site that is designed to exploit these vulnerabilities through an Internet Web browser. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger message that takes them to the attacker's Web site.

Solution

Patch:
Following are links for downloading patches to fix the vulnerabilities:

Impact of the workaround: Setting this flag will require the client to authenticate prior to loading any element from the SSL-protected web site. This will cause the browser to always prompt the user for a client certificate upon connecting to the SSL protected web site.

Refer to the advisory to obtain detailed instructions on applying the workaround.

Windows Movie Maker is an application that allows users to create, edit and add special effects to home movies.

A remote code execution vulnerability exists in the way that Windows Movie Maker handles specially crafted project files. This vulnerability requires a malicious user to send a specially crafted Movie Maker file and convince the user to open the specially crafted file.

Microsoft has released a security update that addresses the vulnerability by changing the way that Windows Movie Maker parses Movie Maker project files.

The vulnerability could allow remote code execution if a user browses a Web site that contains specially crafted content or opens specially crafted HTML e-mail. An attacker who successfully exploits this vulnerability could take complete control of an affected system.

Solution

Patch:
Following are links for downloading patches to fix the vulnerabilities:

Workarounds:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting

2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

3) Restrict Web sites to only your trusted Web sites.

Refer to the advisory to obtain additional details on applying the workarounds.

The MPEG Layer-3 audio codec is delivered as part of Windows Media and as a part of the Windows operating system. A vulnerability exists in the Microsoft MPEG Layer-3 audio codecs when a user opens a specially crafted media file or receives a crafted streaming content.

Microsoft has released a security update that addresses the vulnerability by correcting the way that the Microsoft MPEG Layer-3 audio codecs handle the MPEG Layer-3 audio stream in specially crafted media files.

An information disclosure vulnerability exists because Internet Explorer incorrectly interprets the origin of script, allowing the script to run in the context of a domain or Internet Explorer security zone other than where it originated. (CVE-2010-1258)

Multiple remote code execution vulnerabilities exist in the way Internet Explorer attempts to access an object that has not been initialized or has been deleted. It may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user. (CVE-2010-2556,CVE-2010-2557)

A remote code execution vulnerability exists in the way Internet Explorer attempts to access an object that may have been corrupted due to a race condition. It may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user. (CVE-2010-2558)

A HTML layout memory corruption vulnerability exists in the way Internet Explorer attempts to access incorrectly initialized memory under certain conditions. It may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the logged-on user. (CVE-2010-2560)

Microsoft has released a security update that addresses the vulnerabilities by modifying the way that Internet Explorer enforces security checks and handles objects in memory.

Workarounds:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.

2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

Refer to the advisory to obtain additional details on applying the workarounds.

An attempt to exploit the vulnerability would not require authentication, allowing an attacker to exploit the vulnerability by sending a specially crafted network message to a computer running the Server service.

Solution

Patch:
Following are links for downloading patches to fix the vulnerabilities:

The Cinepak codec is a media encoder and decoder supported by the Windows Media Player. This codec allows bitstream encoding and decoding for media files.

Cinepack codec is prone to a vulnerability because it does not properly handle specially crafted media files.

The vulnerability could allow remote code execution if a user opens a specially crafted media file or receives specially crafted streaming content from a Web site or any application that delivers Web content.

Microsoft has released a security update that addresses the vulnerability by correcting the manner in which the Cinepak code decompresses media files.

This security update is rated Critical for all supported editions of Windows XP, Windows Vista, and Windows 7.

A remote code execution vulnerability exists in the way that Microsoft Office Word handles a specially crafted Word file that includes a malformed record. (CVE-2010-1903)

Microsoft has released an update that addresses the vulnerabilities by modifying the way that Microsoft Office Word opens specially crafted Word files and by modifying the way that Word handles certain properties of rich text data.

This security update is rated Critical for all supported editions of Microsoft Office Word 2007. This security update is also rated Important for all supported editions of Microsoft Office Word 2002, Microsoft Office Word 2003, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac; Open XML File Format Converter for Mac; Works 9; and all supported versions of Microsoft Office Word Viewer and Microsoft Office Compatibility Pack.

Consequence

An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Solution

Patch:
Following are links for downloading patches to fix the vulnerabilities:

2) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or un-trusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.

Impact of workaround #2:
Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.

3) Microsoft Office File Block policy should be used to block the opening of RTF and earlier documents from unknown or untrusted sources.

Impact of the workaround #3:
If File Block policy is configured without special "exempt directory" configuration (see KB922848), Office 2003 files or earlier versions will not open in Office 2003 or 2007 Microsoft Office System.

4) Read e-mails in plain text.

Refer to the advisory to obtain additional details on applying the workarounds.

Microsoft Excel Remote Code Execution Vulnerabilities (MS10-057)

Microsoft Excel is a proprietary spreadsheet application written and distributed by Microsoft.

Microsoft Excel is vulnerable to a remote code execution vulnerability due to a memory corruption issue. This can occur if the user opens a specially crafted Excel file.

Microsoft has released an update that addresses the vulnerability by changing the way that Microsoft Office Excel parses specially crafted Excel files.

This security update is rated Important for all supported editions of Microsoft Office Excel 2002, Microsoft Office Excel 2003, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac; and Open XML File Format Converter for Mac.

Consequence

Successful exploitation allows remote code execution. An attacker who successfully exploits these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Solution

Patch:
Following are links for downloading patches to fix the vulnerabilities:

2) Use the Microsoft Office Isolated Conversion Environment (MOICE) when opening files from unknown or un-trusted sources because it protects Office 2003 installations by more securely opening Word, Excel, and PowerPoint binary format files. Information on MOICE can be found at KB935865.

Impact of the workaround:
Office 2003 and earlier formatted documents that are converted to the 2007 Microsoft Office System Open XML format by MOICE lose their macro functionality. Documents protected with passwords and Digital Rights Management cannot be converted.

3) Microsoft Office File Block policy should be used to block the opening of Office 2003 and earlier documents from unknown or untrusted sources.

Impact of the workaround:
If File Block policy is configured without special "exempt directory" configuration (see KB922848), Office 2003 files or earlier versions will not open in Office 2003 or 2007 Microsoft Office System.

Refer to the advisory for obtaining additional details on applying the workarounds.

TCP/IP is a set of networking protocols that are widely used on the Internet. TCP/IP provides communications across interconnected networks of computers that have diverse hardware architectures and that run various operating systems. The following vulnerabilities exist in TCP/IP processing in Windows.

A denial of service vulnerability exists in TCP/IP processing in Microsoft Windows due to an error in the processing of specially crafted IPv6 packets with a malformed extension header. An attacker could exploit the vulnerability by sending the target system a small number of specially crafted packets, causing the affected system to stop responding. (CVE-2010-1892)

An elevation of privilege vulnerability exists in TCP/IP processing in Microsoft Windows due to an error in the processing of a specific input buffer. An attacker who successfully exploited this vulnerability could run arbitrary code with system-level privileges. (CVE-2010-1893)

An attacker who successfully exploits this vulnerability could run arbitrary code with system-level privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Solution

Patch:
Following are links for downloading patches to fix the vulnerabilities:

The Windows Tracing Feature for Services is vulnerable to the following vulnerabilities:

An elevation of privilege vulnerability exists when Windows places incorrect access control lists (ACLs) on the registry keys for the Tracing Feature for Services. (CVE-2010-2554)

An elevation of privilege vulnerability exists due to the way that the Tracing Feature for Services allocates memory when processing specially crafted long strings from the registry. (CVE-2010-2555)

Microsoft has released a security update that addresses the vulnerabilities by correcting the manner in which tokens are obtained and the length of a string read from the registry is calculated.

This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

Consequence

An attacker who successfully exploits these vulnerabilities could run arbitrary code with system-level privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Solution

Patch:
Following are links for downloading patches to fix the vulnerabilities:

Microsoft .NET Framework and Microsoft Silverlight are exposed to two vulnerabilities.

The vulnerabilities could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications, or if an attacker succeeds in convincing a user to run a specially crafted Microsoft .NET application.

The vulnerabilities could also allow remote code execution on a server system running IIS, if that server allows processing ASP.NET pages and an attacker succeeds in uploading a specially crafted ASP.NET page to that server and executing the page, as could be the case in a Web hosting scenario.

Microsoft has released a security update that addresses the vulnerabilities by modifying the way that Microsoft Silverlight handles pointers and Microsoft .NET CLR handles interfaces.

Workaround:
1) Set Internet and Local intranet security zone settings to "High" to prompt before running ActiveX Controls and Active Scripting.

2) Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone.

Impact of workaround #1 and #2:
On visiting Web sites on the Internet or Intranet that use ActiveX or Active Scripting to provide additional functionality, you will be prompted frequently when you enable this workaround.

3) Temporarily prevent the Microsoft Silverlight ActiveX control from running in Internet Explorer, Chrome and Firefox.

Impact of workaround #3: Applications and Web sites that require the Microsoft Silverlight ActiveX control may no longer function correctly.

4) Disable partially trusted Microsoft .NET applications.

Impact of workaround #4: Some Microsoft .NET applications will not run.

5) Disable XAML browser applications in Internet Explorer.

Impact of workaround #5: Impact of workaround. Microsoft .NET code will not run in Internet Explorer or will not run without a prompt.

These new vulnerability checks are included in Qualys
vulnerability signature
1.27.15-3.
Each Qualys account is automatically updated with the latest
vulnerability signatures as they become available. To view the
vulnerability signature version in your account, from the
Qualys Help menu, select the About tab.

Selective Scan Instructions Using Qualys

To perform a selective vulnerability scan, configure a scan profile to use the following options:

Ensure access to TCP ports 135 and 139 are available.

Enable Windows Authentication (specify Authentication Records).

Enable the following Qualys IDs:

90616

90619

90627

90621

90623

90625

90629

100089

90626

90622

110129

110130

90620

90628

90624

If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.

If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.

In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.